As various forms of distributed computing, such as cloud computing, have come to dominate the computing landscape, modern computing has become a global endeavor. One difficulty encountered when computing on a global scale is the fact that different geographic and/or political regions have different rules and regulations, i.e., data security policies, dictating the various types of secrets, security protocols, and security levels, such as encryption levels and keys, which can be used to protect data within these different geographic and/or political regions.
As a result, the data security policy of a given geographic and/or political region can dictate what secrets can be used to protect data in that geographic and/or political region, e.g., what level of encryption can be used on data within, or data originating from, the geographic and/or political region; what secrets can be sent to that geographic and/or political region, e.g., what encryption keys can be sent to the geographic and/or political region; and what secrets can be applied to data being transferred to the geographic and/or political region, e.g., what type of encryption can be used to encrypt data being sent to the geographic and/or political region.
As a specific illustrative example, the government of China allows only relatively low levels of encryption to be applied to data within China, and/or to be used to protect data that is to be transferred to China. In contrast, many European countries allow for a higher level of encryption to be applied to data within, and/or to be used to protect data that is to be transferred to, their territories. Consequently, an application, service, or system, desiring to encrypt data within China, or transfer data to China, must ensure that the level of encryption used to encrypt data within China, and/or the level of encryption applied to data to be transferred to China, and/or the encryption keys sent to China, conform with Chinese data security policy, while the same application, service, or system desiring to encrypt data within the Germany, or transfer data to Germany, must ensure that the level of encryption used to encrypt data within Germany, and/or the level of encryption applied to data to be transferred to Germany, and/or the encryption keys sent to Germany, conform with German data security policy.
Given that in the modern global computing environment it is often the case that a single application, service, or system is offered, interacts with, and often transfers data between, multiple geographic and/or political regions having different data security policies, ensuring that the data security policies of all the geographic and/or political regions associated with a given application, service, or system can be a daunting, if not overwhelming, task.
This situation, in and of itself, presents a level of complication that often interferes with the efficient processing and transfer of data required in modern computing environments, such as a cloud computing environment. However, the situation is further complicated and aggravated by the fact that there often exist different data security zones, with distinct and different data security policy requirements, within a given geographic or political region, and often within the same computing environment.
As an example, an application or service implemented in a cloud computing environment may, in some cases, be offered and used in different data security zones within the same cloud computing environment or network, and, in some situations, by the same user. In this case, just as in the case of two different geographic or political regions, it must be confirmed that the data security policies of all data security zones are known/understood and met.
As used herein, a given geographic zone, political zone, data security zone, resource, and/or computing environment, having its own associated data security policy is referred to as a data security jurisdiction zone. Consequently, as used herein, the term data security jurisdiction zone refers to both geographic and political zones as well as virtual data security zones within various computing environments.
As used herein, data representing secrets that can be used to protect data in a given data security jurisdiction zone, and/or data representing secrets that can be sent to the data security jurisdiction zone, and/or data representing data being transferred to the data security jurisdiction zone that has been protected by a secret that can be used to protect data in the data security jurisdiction zone, are collectively, and/or individually, referred to as allowed secrets data with respect to the data security jurisdiction zone.
It follows that, as used herein, data representing secrets that can't be used to protect data in a given data security jurisdiction zone, and/or data representing secrets that can't be sent to the data security jurisdiction zone, and/or data representing data being transferred to the data security jurisdiction zone that has been protected by a secret that can't be used to protect data in the data security jurisdiction zone, are collectively, and/or individually, referred to as prohibited secrets data with respect to the data security jurisdiction zone.
Given the situation described above, significant amounts of time and energy are currently devoted to ensuring that the data security policies associated with various data security jurisdiction zones are met before secrets and/or secrets protected data are transferred to the data security jurisdiction zones. As noted, this often significantly interferes with the efficient and effective operation of various, and numerous, computing environments.
What is needed is a method and system to automatically determine the data security policies associated with various data security jurisdiction zones and then ensure only allowed secrets data is provided to each data security jurisdiction zone.